Lucene search
+L

1157275 matches found

Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•95 views

OpenCMS - Cross-Site Scripting

OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. id: CVE-2023-42343 info: name: OpenCMS - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. impact: | Unauthenticated attackers...

6.1CVSS8.2AI score0.0059EPSS
SaveExploits0References1
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•82 views

Custom 404 Pro < 3.7.3 - Cross-Site Scripting

Custom 404 Pro before 3.7.3 is susceptible to cross-site scripting via the search parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

6.1CVSS6.8AI score0.0171EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•76 views

osTicket < v1.16.6 - Cross-Site Scripting

Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6. id: CVE-2023-1318 info: name: osTicket v1.16.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to...

5.4CVSS6AI score0.01015EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•93 views

WWBN AVideo 11.6 - Cross-Site Scripting

A reflected XSS vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff, allowing arbitrary Javascript execution. id: CVE-2023-48728 info: name: WWBN AVideo 11.6 - Cross-Site Scripting author: ritikchaddha severity: medium...

9.6CVSS7.1AI score0.02268EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•106 views

mojoPortal v.2.7.0.0 - Cross-Site Scripting

Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component. id: CVE-2023-44012 info: name: mojoPortal v.2.7.0.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross...

6.1CVSS7AI score0.01258EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•53 views

Mlflow - Cross-Site Scripting

The vulnerability allows an attacker to inject malicious code into the Content-Type header of a POST request, which is then reflected back to the user without proper sanitization or escaping. id: CVE-2023-6568 info: name: Mlflow - Cross-Site Scripting author: ritikchaddha severity: medium...

6.5CVSS6.7AI score0.01662EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•93 views

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS7.2AI score0.00845EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•101 views

Wordpress Multiple Themes - Reflected Cross-Site Scripting

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

6.1CVSS7AI score0.01011EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•71 views

OURPHP <= 7.2.0 - Cross Site Scripting

OURPHP a...

6.1CVSS6.4AI score0.08115EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•31 views

WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks. id: CVE-2023-6000 info: name: WordPress Popup Builder = 4.2.3 - Unauthenticated Stored XSS author: riteshs4...

6.1CVSS7.2AI score0.01999EPSS
SaveExploits4References4
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•141 views

Structurizr on-premises - Cross Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository structurizr/onpremises prior to 3194. id: CVE-2023-5556 info: name: Structurizr on-premises - Cross Site Scripting author: shankaracharya severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository...

6.1CVSS6AI score0.01222EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•59 views

WP Go Maps <= 9.0.29 - Cross-Site Scripting

WP Go Maps formerly WP Google Maps plugin for WordPress versions before 9.0.30 is vulnerable to Reflected Cross-Site Scripting via the 'mapid' parameter in the admin map edit page. id: CVE-2024-29931 info: name: WP Go Maps = 9.0.29 - Cross-Site Scripting author: Shivam Kamboj severity: medium...

7.1CVSS8.1AI score0.00753EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•69 views

Gradio - Open Redirect

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

6.1CVSS6.1AI score0.01021EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•42 views

Memos 0.13.2 - Server-Side Request Forgery

SSRF vulnerabilities exist in the memos API service /o/get/httpmeta that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the...

5.8CVSS6.2AI score0.01049EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•34 views

WP Dream Carousel < 1.0.1b - Cross-Site Scripting

WP Dream Carousel WordPress plugin 1.0.1b contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires victim to load a...

8.3AI score0.00584EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•49 views

WordPress User Messages <= 1.2.4 - Reflected XSS

WordPress User Messages plugin = 1.2.4 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to load a...

8.1AI score0.00584EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•104 views

eyoucms v.1.6.5 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. id: CVE-2024-22927 info: name: eyoucms v.1.6.5 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS...

6.1CVSS6.7AI score0.01019EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•20 views

Simple Certain Time to Show Content - Cross-Site Scripting

Simple Certain Time to Show Content WordPress plugin 1.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users such as admin, explo...

8.3AI score0.0063EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•50 views

LiteSpeed Cache <= 6.5.0.2 - Stored XSS

LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input. id: CVE-2024-47374 info...

7.1CVSS5.9AI score0.01408EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/30 2:12 a.m.•35 views

WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting

The WPMovieLibrary WordPress plugin through version 2.1.4.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'order' parameter in the import page before outputting it back, which could allow attackers to execute arbitrary JavaScript cod...

8.5AI score0.00681EPSS
SaveExploits1References2
Rows per page
Query Builder